Security readout for executives and security teams
Plain-English summary
This is a local privilege-escalation issue in Trend Micro endpoint agents. A person who already has local access to an affected system could abuse link-following behavior in the scanning function. Trend Micro says the fix was delivered automatically through ActiveUpdate in an updated Spyware pattern.
Executive priority
Treat this as a patch-hygiene and endpoint coverage priority, not an emergency based on the provided evidence. The business risk rises for unmanaged, offline, or update-failing endpoints because local attackers could gain higher privileges.
Technical view
CVE-2022-36336 affects Trend Micro Apex One 2019/SaaS and Worry-Free Business Security 10.0 SP1/SaaS agents. The described flaw is link following in the scanning function, enabling local privilege escalation on affected installations. The bundle provides no CVSS score, CWE, or pattern version details.
Likely exposure
Exposure is most likely on endpoints running the named Trend Micro agent versions that are not current on detection patterns. Systems receiving ActiveUpdate successfully should already have the vendor-provided Spyware pattern mitigation.
Exploitation context
The provided bundle does not show active exploitation, and KEV status is false. Public references include Trend Micro and ZDI advisories, but no exploit status or exploitation-in-the-wild evidence is cited.
Researcher notes
Key gaps are missing CVSS, CWE, affected build granularity, and exact fixed Spyware pattern version. Avoid assuming remote exploitability; sources describe a local attacker. Validation should focus on endpoint version inventory and pattern-update evidence.
Mitigation direction
- Verify ActiveUpdate is enabled and completing successfully on all affected agents.
- Confirm endpoints are current on Trend Micro detection and Spyware patterns.
- Review Trend Micro advisory 000291267 for current vendor instructions.
- Prioritize stale, offline, or update-failing endpoint agents for remediation.
Validation and detection
- Inventory Apex One and Worry-Free Business Security agent versions across endpoints.
- Check pattern currency and last successful ActiveUpdate time on affected agents.
- Confirm vulnerability scanners reflect the updated Trend Micro advisory state.
- Review local privilege exposure where update status cannot be confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-36336 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://success.trendmicro.com/solution/000291267CVE reference · x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-22-1033/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.